npm's Hidden Vulnerability: Single Maintainers Controlling Millions of Downloads

npm's most critical packages—including esbuild (190M weekly downloads), chalk (413M), and sharp—are controlled by single maintainers, creating catastrophic supply chain risks. A compromised npm token can publish malicious code to millions of developers in minutes, as demonstrated by recent 2026 attacks on axios and LiteLLM. Understanding and mitigating these structural vulnerabilities is essential for securing the JavaScript ecosystem.